I recently investigated a Red Bull-themed phishing campaign that bypassed all email protections and landed in user inboxes.

The attacker used trusted infrastructure via post.xero.com and Mailgun, a classic living off trusted sites tactic. SPF, DKIM and DMARC all passed. TLS certs were valid.

This campaign bypassed enterprise grade filters cleanly... By using advanced phishing email analysis including header analysis, JARM fingerprinting, infra mapping - we rolled out KQL detections to customers.

Key Takeway: No matter how good your phishing protections are, determined attackers will find ways around them. That's where a human-led analysis makes the difference.

Full write-up (with detailed analysis, KQL detections & IOCs)

https://evalian.co.uk/inside-a-red-bull-themed-recruitment-phishing-campaign/